DeepSeek

The NYT breaks down why 'distillation' became a flashpoint in US-China AI talks. Anthropic and OpenAI accuse Chinese firms of distilling their proprietary models, but experts say the claim is overblown—distillation only captures output text, not source code or training internals. Chinese labs still need to build a strong base model first. The piece also notes Anthropic just paid $1.5B for using copyrighted data, and OpenAI faces a similar suit from the NYT. U.S. courts haven't ruled on whether distillation violates trade-secret law.

DeepSeek published a paper on DSec, their internal sandbox system for training agents at scale. The idea is to let models practice with real tools in isolated environments that scale elastically. It handles 100K concurrent sandboxes, 11-second startup latency, and roughly $3 per sandbox. The post doesn't mention a code repo—only the arXiv paper is available so far.

This NYT feature traces China's AI strategy. Xi Jinping declared in 2014 that China must be a top AI maker, not just a buyer. The first national AI plan followed in 2017, targeting global leadership by 2030. State-led funds poured over $184 billion into AI firms from 2000 to 2023, with hundreds of billions more pledged last year. Unlike the US focus on AGI, China prioritizes immediate deployment in factories, hospitals, and classrooms, aiming for AI tools to cover 90% of society by 2030. DeepSeek's breakthrough restored confidence, but regulators tightened controls on chatbots and restricted overseas travel for top AI entrepreneurs. Beijing dismisses global calls to slow AI development, seeing them as a way to lock in US dominance.

Kyle Chan argues in the NYT that the US and China worry about fundamentally different AI risks. US labs focus on recursive self-improvement and existential threats; Chinese policymakers see that takeoff as distant and instead fear deepfakes, political dissent, and social instability. Recent cases—OpenClaw data leak warnings, Mythos’s cyber offense capabilities, and an AI tool cracking WeChat accounts—are pushing Beijing to also take cyber and runaway AI risks more seriously. Chan suggests both sides start by acknowledging each other’s risk perceptions before jumping to arms-control talks.

Cactus open-sourced Needle 3, an automation model for phones, wearables, robots, and other tiny devices. The whole model is 8-29 MB, built on Simple Attention Networks where every layer is a usable sub-network. A fine-tuned 4-layer sub-network beats DeepSeek V4 Flash on mobile tool-calling benchmarks; on extraction it matches models 2-3x its size. It runs fully offline at 400-4,000 tokens/s decode on a Raspberry Pi 5. The Python package supports tool calls, structured extraction, and text embeddings. The post does not disclose training data composition or fine-tuning cost.

Enclave tested DeepSeek V4.1 Flash against 11 vulnerable targets and 4 patched controls. The model achieved code execution on all 11 targets for $4.65 total, using 2,349 Bash commands over nearly 2h38m of active model time. An audit confirmed 6 attacks followed the planned exploit path; 5 found alternate routes in the test environment, including a Grafana compromise in 52 seconds. Enclave has since closed those extra paths and will require re-runs for updated leaderboard rankings.

A developer forked ds4 and tuned it for DeepSeek V4.1 Flash Q4 on a 512 GB M3 Ultra, lifting decode from 16.6 t/s to 31.3 t/s, and to 40.5 t/s with DSpark speculative decoding. The ~300 GB Q4 weights fit only the 512 GB M3 Ultra. The speedup comes from cutting Metal dispatch overhead: the 384-expert router went from 9 dispatches to 1, the shared expert gate+up+SwiGLU became a single kernel, and BF16 rounding moved inside producer kernels, removing ~770 re-round dispatches. At 300k context, compressed attention selection was the bottleneck; the fix scores only admitted blocks and uses a bounded radix select, keeping decode at 90% of the 8k rate. DSpark verifies 6 tokens per step with shared weight streams and overlapped Engram fetches, dropping verify latency from 177 ms to 112 ms. Output is byte-identical to upstream under greedy decode, with SHA-256 manifests provided. The branch is M3 Ultra only because the optimizations rely on measured behavior of this specific chip's dual-die memory, 80-core GPU scheduling, and Metal dispatch characteristics.

今天最直观的教训来自 @搞仁义毛义仁：给 Astra 一个空白 C++ 仓库，代码写得一塌糊涂；把积累了大量 code review 经验的 GacUI 上下文导进去，质量立刻飙升。这说明模型不是不会写，是得用具体规则去“规训”。@今天群内信息量极大 实测了 Ollama Cloud 跑 DeepSeek V4.1 Flash，解码吞吐是官方 API ...

Fireworks ran a full benchmark suite on DeepSeek-V4.1-Flash. On DeepSWE, it scores 74.34% pass@1, in the same band as GPT-6 Astra at 74.12%, but costs $0.43 per task—15x cheaper. The model uses a 552B MoE with a split activation design: 8B active for input, 16B for output, plus KV cache optimizations. On Terminal-Bench 2.1 it trails Astra by 1 point while costing 12x less. The post mentions an HLE and oracle router eval but does not disclose the actual scores.

DeepSeek V4.1 Flash assigns 196B parameters to Engram, a conditional memory module stored in host RAM instead of GPU VRAM. Lookup keys are built from the last few tokens, so addresses are known ahead of time; RDMA prefetch hides the transfer latency behind computation. In the paper's self-reported results, reasoning gains outpace knowledge gains: BBH +5.0, needle-in-a-haystack retrieval jumps from 84.2 to 97.0. The mechanism: offloading static local mappings frees up early-layer compute and attention budget for multi-step reasoning and long-range dependencies. The team also introduces 'sparsity allocation'—experiments suggest ~20–25% of sparse capacity going to Engram works best, though no independent replication exists yet. Qwen3.8 Flash-Next adopts a similar design, signaling that external static memory is entering the mainstream.

DeepSeek dropped V4.1-Flash on Sep 10. Despite the 4.1 label, Sebastian Raschka called it a V5-level rewrite. It's a 763B total-parameter MoE with a causal encoder-decoder split: 8B active for prefill, 16B for decode, yielding 1–2% sparsity and up to 8× smaller KV cache vs V4 Flash. Native vision is built in, and V4 Pro has been quietly retired. The post doesn't include benchmark tables but argues current evals miss the point—the real advance is context efficiency for long-running agents.

Anthropic's September threat report says a team used 5,380 fake accounts to reroute ~300K user requests to Claude over 10 days. The exposed data includes a pharma firm's multi-country budget sheet, live Telegram and Feishu credentials, and police ID checks. Independent researcher Shou claims to have bought a 6TB dataset with SSH keys and cloud tokens—single-source, unverified. Anthropic estimates 180M+ unauthorized distillation calls: Alibaba 151M, Moonshot ~23M, DeepSeek 12.1M. DeepSeek specifically routes requests containing Claude Code markers to reasoning models. DeepSeek's terms allow training on inputs; Kimi's web UI has no opt-out toggle—users must email and wait 5–7 business days. Technical defenses protect model outputs, not user inputs. The named companies haven't publicly responded; attribution rests solely on Anthropic's account.

DeepSeek released open weights for V4.1-Flash, a 552B MoE model with a Causal Encoder-Decoder architecture tuned for coding agents. It splits compute asymmetrically: 8B active params during prefill, 16B during decode, plus improved KV cache efficiency. On Terminal Bench 2.1 it hits 90.6; on Automation-Bench it scores 54.8—better than V4-Pro but still failing roughly half of complex workflows, so keep a human in the loop. It is also DeepSeek's first non-experimental model with native image input. Chartography reaches 78.9, but ZeroBench logical reasoning over images is only 49. DeepSeek has already retired V4-Flash traffic and will reroute V4-Pro traffic to V4.1-Flash starting September 14.

Anthropic's September threat report reveals DeepSeek and Moonshot (Kimi) silently forwarded user requests to Claude without consent, exposing code and credentials to third parties. A 6TB data leak from the same router contained SSH keys, cloud credentials, and GitLab tokens capable of compromising 7 government entities and 19 enterprises. The report also names seven Chinese labs—including Alibaba, Zhipu, and Xiaomi—for large-scale distillation attacks on Claude totaling over 180 million interactions. The same day, Anthropic paused new $200 Pro 20x subscriptions as Astra capacity tightened. DeepSeek launched V4.1 Flash, merging its Pro and Flash lines; V4 Pro sunsets September 14. Zhipu partnered with Hangzhou's Shangcheng district on a city-wide coding subsidy, offering 51% off annual personal plans.

DeepSeek released V4.1 Flash, compressing the global KV cache to about 1/4 and persistent KV cache to 1/8 of the previous generation, while cutting cache-hit input prices by roughly 60%. The tech report argues that sparse attention has already squeezed compute costs low; what now drags down long-running agent tasks is HBM filling up, SSD offloading, and bus transfers. Flash tackles this with 4-bit storage, cross-layer global-cache reuse, and dropping sliding-window disk writes, shifting the cost center from compute to the memory hierarchy. On deployment, DeepSeek initially planned to route all V4 Pro traffic to Flash immediately, but pushed the cutover to Sept 14 after developer pushback. The report also flags potential position-selection bias from layer reuse and degradation risks in extreme long-context cache reconstruction. All throughput and reduction figures are self-reported, not independently verified.

Anthropic's September threat-intel report calls out DeepSeek, Xiaomi, and Moonshot for piping user-model conversations into Claude and using Claude's replies as training data for distillation. The exchanges reportedly contained sensitive info from individual users, multinationals, and state-affiliated actors. Anthropic says this violates PRC law and suggests sharing detailed findings with China's Ministry of Public Security via the FBI. The post doesn't disclose the volume of conversations or the time range involved.

Artificial Analysis reports DeepSeek V4.1 Flash hits 40 on the Intelligence Index, edging out DeepSeek V4 Pro 0813 as DeepSeek's top-scoring model. It uses 8B active parameters for input and 16B for output, supports 1M token context, and is MIT-licensed. The post doesn't disclose inference speed or pricing, so I'd hold off on cost-performance claims for now.

SiliconFlow launched DeepSeek-V4.1-Flash on Day 0. It's a 552B MoE model with ~8B active params during prefill and ~16B during decode, native vision, and a 1M-token context window. KV cache footprint is about 1/4 of V4 Flash, which helps with deployment cost. MIT license keeps commercial use straightforward.

DeepSeek released V4.1-Flash, a 552B-parameter model built to slash memory costs for AI agents. Its KV cache in fast GPU memory is about a quarter the size of V4-Flash, and the offloaded portion shrinks to roughly an eighth. The model splits into an encoder and decoder: only 8B parameters activate per token during input processing, versus 16B during text generation, nearly halving input compute. It supports 1M-token contexts and stores the main KV cache in FP4. On the DeepSWE v1.1 coding benchmark it scores 74.2%, narrowly beating Anthropic Opus 5 and OpenAI GPT-5.6 Sol, but it still trails on complex scientific tasks and image analysis. Weights are on Hugging Face under the MIT license. The post does not disclose inference latency or specific hardware requirements.

DeepSeek released V4.1-Flash with a new Causal Encoder-Decoder architecture and native vision understanding — no separate vision model needed. It's a 552B MoE, activating 8B params for input and 16B for output. The post doesn't disclose the exact price cut or benchmark numbers, so I'd wait for third-party evals before getting excited.